I have a rsyslog Server which have the below settings,Where its getting all the remote Linux systems logs and network logs.
# cat /etc/rsyslog.conf $ModLoad imudp $UDPServerRun 514 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $template noida-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log" authpriv.* ?noida-dc *.info,mail.none,authpriv.none,cron.none ?noida-dc $IncludeConfig /etc/rsyslog.d/*.conf
Whereas Linux system logs are log as they are storing into
/scratch/rsyslog with their hostames by creating a directory with hostnames itself and then creating a message file within it, that's fine.
However, i want to segregate the network logs which basically creates a Folder by Month names like
Jan Feb Mar and then creates a
message.log as well but as network logs do not have hostnames it Just creating a dir based on the moth name and keeping the only one file into it thats
messages.log, my wish is to have these network logs to a different Directory like
Below is message format within the network log directory
Dec 2 19:04:22 Dec 02 13:34:22.768 cisco-apic-1 %LOG_-3-SYSTEM_MSG
So, Is there a way to tell rsyslog if remote message contains
Jan then must go to
What i tried as Follows but not working.
$template mynets,"/scratch/network/%HOSTNAME%/messages.log" if $fromhost contains 'cisco-apic-1' then -?mynets & stop
$template mynets,"/scratch/network/%HOSTNAME%/messages.log" if $fromhost startswith 'Dec' then -?mynets & stop
Linux Distro is : Centos 6